RBI Cyber Security Framework: A Complete 2026 Compliance Guide

Who the RBI Cyber Security Framework applies to

The framework's expectations reach across the RBI-regulated ecosystem: scheduled commercial banks, cooperative banks, NBFCs (with tiered obligations by size), and - through separate but related Master Directions - payment aggregators (PA) and payment gateways (PG).

Crucially, the depth of controls scales with your risk and size. A large private bank faces a far more prescriptive baseline than a base-layer NBFC, but every regulated entity must demonstrate governance, monitoring, and incident response.

Core controls the framework expects

• A board-approved cyber-security policy, distinct from the broader IT policy
• A named Chief Information Security Officer (CISO) with a direct reporting line
• Baseline security controls: network segmentation, secure configuration, patch and vulnerability management
• Continuous surveillance - a SOC or managed detection capability with defined escalation
• Vulnerability Assessment and Penetration Testing (VAPT) of critical and internet-facing systems
• Application security testing across net-banking, mobile banking and APIs
• Vendor / third-party risk management and outsourcing controls
• Incident response, business continuity (BCP) and disaster recovery (DR) that is tested, not just documented

VAPT and application security under RBI

RBI expects regular, credible VAPT - not a once-a-year checkbox scan. Testing should cover the OWASP Top 10 and business-logic flaws, be performed by competent testers, and produce risk-rated findings with proof-of-concept and clear remediation.

For customer-facing channels (net-banking, UPI apps, mobile banking), application security testing to a recognized standard (OWASP WSTG / MASVS) is expected, and findings must be tracked to closure with re-testing.

Incident reporting and data localization

RBI-regulated entities must report material cyber incidents promptly. This dovetails with CERT-In's directions requiring reporting of listed incidents within six hours of detection - so your incident-response runbook must be built for that timeline.

RBI also enforces payment-data localization: data relating to payment systems must be stored within India. Architecture and vendor choices need to reflect this from the design stage, not as an afterthought.

How to become and stay RBI-compliant

• Run a gap analysis of your current controls against the framework and applicable Master Directions
• Close technical gaps: segmentation, hardening, logging, MFA, and a real monitoring capability
• Establish governance: board-approved policy, CISO, and a reporting cadence
• Schedule recurring VAPT and application security testing with tracked remediation
• Build and rehearse an incident-response plan aligned to the 6-hour CERT-In timeline
• Maintain a defensible evidence pack for supervisory review